Design and operate the log management infrastructure per NIST SP 800-92 Chapter 3 (Log Management Infrastructure) + Chapter 5 (Operational Processes). Log management infrastructure architecture per Section 3.2: (a) tiered architecture covering generation + collection + storage + analysis + reporting, (b) high-availability across collection and storage tiers with documented RTO/RPO, (c) capacity sizing per Section 3.4 with documented log volume forecasting + growth model + headroom planning. Centralised log collection per Section 3.2.2: forwarders or agents (host-installed + sidecar + agentless cloud + tap) deliver to one or more central log management systems + minimise local log retention to reduce attacker advantage. Log transport security per Section 5.3: encrypted in transit (TLS preferred + IPsec + or equivalent), authenticated source + destination, integrity validation, queue/buffer for network outages with replay-on-recovery. Log forwarding agents and health monitoring per Section 5.4: monitor agent liveness + version + configuration drift + delivery success rate + back-pressure + queue depth + with alerting on agent silence (silent failure is the most common log-management failure mode). SIEM and detection platform governance: documented platform owner + platform SLA + correlation rule lifecycle + analyst onboarding + tuning cadence + use-case coverage per MITRE ATTandCK + integration with case management.
Maintained by Gerard Blokdyk·Verified against the published standard ·Control text last updated
What else in your programme already covers this
This control maps to 88 controls across 41 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.